Testing Provisioning

Identity Security Cloud (ISC) ISC Discussion and Questions
1

What is the best/quickest way to test provisioning for an existing Identity?

I can add a user to the Identity List of a Role, but when the update is run it checks all users which can take some time.

Example: Testing JDBC Provisioning Rule

  1. Update Rule
  2. Add Existing User to Identity List for Role/AP for that Source
  3. Update Role
2

My personal workflow is:

  • Develop solid Java code and test it locally in my IDE: it prevents to upload JAR, and all. By developing and testing locally, it saves a lot of time!
  • Create the rule: the rule can be pretty simple and call your class
import a.b.c.MyRule;
return MyRule.provision( application, connection, plan);
  • Upload the latest version of my JAR (thanks maven for generating this for me) for the source
  • Then I usually create an access profile for my source, without workflow approval
  • I create a “dummy” app to request that access profile
  • I request this access profile for a “dummy” user

If I have to request several times the same access profile for the same user, I usually ends up leveraging postman the create the access request for me, so a simple click would suffice instead of the handful clicks required to create the access request.
Hope this helps!

3

Thanks Yannick!

Using Postman lines up with some creation I had done in the past and works well for this.

  1. Search for user and get their id
  2. Search for a Role (Access Profile) and get the role-id
  3. Grant access for that id to the role-id and the provisioning is triggered
4

It sure works.
I’m a bit more leazy than that.
I create the access request in the browser with the developer tools on. So I get the payload and copy/paste it as is in postman.

5

You can add identity manually in role(Use identity list as selection criteria) and then run single identity refresh with old cc api. This would run single identity refresh and not all roles would get refreshed.

When you want to test deprovision, remove that identity from list, save role and then run single identity refresh again.

6

What is the cc api for single identity refresh?

7

POST /cc/api/system/refreshIdentities

Then use Body for a Filter. I have used UID or Name, but stick with UID.

{
   "filter" : "uid == \"SomeUID\"",
   "refreshArgs" : {
     "correlateEntitlements" : "true",
     "promoteAttributes" : "true",
     "refreshManagerStatus" : "false",
     "synchronizeAttributes" : "false",
     "pruneIdentities" : "false",
     "provision" : "true"
   }
}
2 Likes